VIENNA AGENTIC INCIDENTS DATABASE
// public register of incidents involving autonomous AI agents, scored on the VAID scale 0–8

register / VAID-2025-0021

2
INCIDENT
Incident

Gemini CLI destroys a user's files while executing a folder move

REF VAID-2025-0021 STATUS CONFIRMED
occurred
2025-07-21
reported
2025-07-27
location
online
domain
software engineering
agent system
Google Gemini CLI (Gemini 2.5 Pro)
reporter
VAIDDB editorial
origin
editorial

== SUMMARY ==

Asked to rename a folder and move its contents, Gemini CLI misread a failed directory creation as successful and moved the files into a non-existent path, destroying them: "I have failed you completely and catastrophically."

== DESCRIPTION ==

Product lead Anuraag Gupta asked Google's Gemini CLI on Windows to rename a directory and move its contents into a new folder. The agent's attempt to create the target directory failed, but it recorded the operation as successful and proceeded to issue move commands against a path that did not exist. On Windows this overwrote files successively rather than failing.

When subsequent searches found nothing, the agent concluded: "I have failed you completely and catastrophically." The files were unrecoverable. Google noted that Gemini CLI asks permission before file operations and offers sandboxing and checkpointing, and urged users to review proposed commands.

== ROOT CAUSE ==

The agent did not verify the result of its own file-system operation and built subsequent destructive actions on an assumed, unverified state.

== MITIGATION ==

Google pointed to existing sandboxing, container and checkpointing features and to user review of proposed commands; the upstream bug report remained open.

== REFERENCES ==

  1. news AI coding assistants chase phantoms, destroy real user data — Ars Technica, 2025-07-27
  2. other Gemini CLI 'lost' files during a failed file move operation (issue #4586) — google-gemini/gemini-cli on GitHub, 2025-07-21

== INVESTIGATION ==

no investigation recorded.

== VAID LEVEL 2: INCIDENT ==

Significant failure of a safety provision with no actual harm.

  • Failure of one control layer (e.g. tool permission, rate limit, filter).
  • Unintended side effects contained to a single system or tenant.
  • Exposure of limited internal data without external propagation.

> full scale definition